CVE-2025-62517: rollbar vulnerable to Prototype Pollution in merge()

The vulnerability is a prototype pollution issue within the Rollbar.js library, specifically in the merge() and set() utility functions. The advisory mentions that the rollbar.configure() function is the entry point for the vulnerability, which internally uses these utility functions. The provided patches confirm this by showing modifications to src/merge.js and src/utility.js. In both cases, the fix involves preventing the modification of Object.prototype. In merge.js, the result object is now created with Object.create(null), which means it does not have a prototype and is therefore immune to prototype pollution. In utility.js, the set() function now explicitly sets the prototype of the input object to null using Object.setPrototypeOf(obj, null). These changes clearly indicate that the merge and set functions were the sources of the prototype pollution vulnerability. An attacker could exploit this by passing a malicious object to rollbar.configure(), which would then be processed by these vulnerable functions, leading to the pollution of the global Object.prototype.